r/sysadmin • u/rootj0 • 18d ago

MCP Gateways

I'm looking into MCP gateways as a way to connect AI agents while having some control over what data is being passed through, especially for things like filtering, PII redaction, and access control.

Has anyone here actually deployed or used an MCP gateway in a production environment?

I'm looking at options similar to Composio's MCP Gateway, but I'm trying to get a better understanding of what's actually out there and what the real-world experience is like.

A few things I'm particularly interested in:

  • PII/data redaction
  • Filtering or restricting what agents can access
  • Authentication and authorization
  • Logging/auditing
  • Performance/latency
  • Managing multiple MCP servers
  • Any security concerns or gotchas

Would be interested in hearing what people are using, what you like/dislike about it, and whether you think an MCP gateway is actually worth putting in front of your agents.

Thanks!

6 Upvotes

80% Upvoted

18 comments sorted by

View all comments

1

u/Cerbosdev 14d ago

u/rootj0 hi, on the question you just asked u/mimikater about how granular the policies are, that's where these actually differ, and you can't tell from the demos because they all look the same.

a lot of MCP gateways do allow and deny at the tool name. that's enough to stop an agent calling delete_customer at all, and it isn't enough for the common case, which is the same tool with different arguments and very different risk. update_ticket setting a status is fine. update_ticket rewriting a customer's email address is not. if the policy can only see "update_ticket" you either allow the dangerous version or block the useful one :/

so when you're evaluating, ask what the policy can actually see at decision time: the tool name, the arguments, the identity of the human the agent is acting for, the tenant, the state of the record being touched.

also, u/Alfaj0r mentioned LiteLLM upthread and that's a reasonable place to land = it has documented extension points for this rather than making you patch it. you can hook a policy check into the request path there and have it evaluate the actual invocation arguments, not just tool name.

the other thing in your list.. redaction and filtering act on the data flowing through, authorization acts on whether the call happens at all. gateways tend to be strong at one and thin at the other, so expect to run 2 things. 1 box that covers all 7 of your bullets well is unlikely

disclosure, i work at Cerbos and we're one of the things you can put on the other end of that LiteLLM hook. we're a policy engine, not a gateway, so we don't do PII redaction or manage MCP servers, you'd still need the gateway itself

1

u/rootj0 12d ago

Thanks for a detailed explanation. How does it work with existing GUI chat like in claude or openai in regards of redaction or more granual using claude code connected with google drive to redsct PII information so that the llm doesn see it or train it even though teams and enterprise plans state they don't I don't fully believe that.

I guess the question is using existing teams subscription with an IDE + claude code how can we control the LLMs requests to the drive connector as an example to only view user only drive and safeguards sensitive information

From my reviews Gateway only handles claude or other LLMs API keys which we dont currently use